Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Manager Computer Profile Store Registrar] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Manager Computer Profile Store Registrar] 'ImagePath' = 'C:\cotvkuvaumsgu\lfydvtmct.exe'
Создает следующие сервисы
- 'Manager Computer Profile Store Registrar' C:\cotvkuvaumsgu\lfydvtmct.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\cotvkuvaumsgu\ztkuwr
- C:\cotvkuvaumsgu\ztkuwr
- C:\cotvkuvaumsgu\ztk84k9h1cbmu3jtulo.exe
- C:\cotvkuvaumsgu\lfydvtmct.exe
- C:\cotvkuvaumsgu\obmcchksnfnc.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\cotvkuvaumsgu\lfydvtmct.exe
- C:\cotvkuvaumsgu\obmcchksnfnc.exe
Удаляет следующие файлы
- %WINDIR%\cotvkuvaumsgu\ztkuwr
- C:\cotvkuvaumsgu\ztk84k9h1cbmu3jtulo.exe
Подменяет следующие файлы
- %WINDIR%\cotvkuvaumsgu\ztkuwr
Сетевая активность
Подключается к
- 'an####govern.net':80
- 'va####senough.net':80
- 'gl###cover.net':80
- 'gl####ompany.net':80
- 'or####ompany.net':80
- 'ge####further.net':80
- 'he###cover.net':80
TCP
Запросы HTTP GET
- http://va####senough.net/index.php
- http://gl###cover.net/index.php
- http://gl####ompany.net/index.php
- http://or####ompany.net/index.php
- http://ge####further.net/index.php
- http://he###cover.net/index.php
UDP
- DNS ASK ge###eproud.net
- DNS ASK di#####ltfurther.net
- DNS ASK gl####ompany.net
- DNS ASK an####company.net
- DNS ASK gl###become.net
- DNS ASK an####become.net
- DNS ASK gl###cover.net
- DNS ASK an###rcover.net
- DNS ASK gl####urther.net
- DNS ASK an####further.net
- DNS ASK fo####dcompany.net
- DNS ASK de####company.net
- DNS ASK fo####dbecome.net
- DNS ASK he####urther.net
- DNS ASK de####become.net
- DNS ASK de###ecover.net
- DNS ASK fo####dfurther.net
- DNS ASK de####further.net
- DNS ASK re####govern.net
- DNS ASK va####sgovern.net
- DNS ASK re####enough.net
- DNS ASK va####senough.net
- DNS ASK re####needle.net
- DNS ASK va####sneedle.net
- DNS ASK re####nature.net
- DNS ASK va####snature.net
- DNS ASK ge####govern.net
- DNS ASK fo####dcover.net
- DNS ASK di####ultcover.net
- DNS ASK he###cover.net
- DNS ASK di####ultbecome.net
- DNS ASK he####company.net
- DNS ASK le####company.net
- DNS ASK he####become.net
- DNS ASK le####become.net
- DNS ASK he###ncover.net
- DNS ASK le###rcover.net
- DNS ASK he####further.net
- DNS ASK le####further.net
- DNS ASK re####ecompany.net
- DNS ASK or####ompany.net
- DNS ASK re####ebecome.net
- DNS ASK or###become.net
- DNS ASK re####ecover.net
- DNS ASK or###cover.net
- DNS ASK re####efurther.net
- DNS ASK or####urther.net
- DNS ASK ne#####rycompany.net
- DNS ASK pl####ntcompany.net
- DNS ASK ne####arybecome.net
- DNS ASK pl####ntbecome.net
- DNS ASK ne####arycover.net
- DNS ASK pl####ntcover.net
- DNS ASK ne#####ryfurther.net
- DNS ASK pl####ntfurther.net
- DNS ASK he####ompany.net
- DNS ASK di#####ltcompany.net
- DNS ASK he###become.net
- DNS ASK ge####enough.net
- DNS ASK ge####further.net
- DNS ASK ge####needle.net
- DNS ASK he####govern.net
- DNS ASK gl###govern.net
- DNS ASK an####govern.net
- DNS ASK gl###enough.net
- DNS ASK an####enough.net
- DNS ASK gl###needle.net
- DNS ASK an####needle.net
- DNS ASK gl###nature.net
- DNS ASK an####nature.net
- DNS ASK fo####dgovern.net
- DNS ASK de####govern.net
- DNS ASK fo####denough.net
- DNS ASK de####enough.net
- DNS ASK di####ultnature.net
- DNS ASK fo####dneedle.net
- DNS ASK fo####dnature.net
- DNS ASK de####nature.net
- DNS ASK re####complete.net
- DNS ASK va####scomplete.net
- DNS ASK re###nproud.net
- DNS ASK va####sproud.net
- DNS ASK re####around.net
- DNS ASK va####saround.net
- DNS ASK re####welcome.net
- DNS ASK va####swelcome.net
- DNS ASK ge####complete.net
- DNS ASK he####omplete.net
- DNS ASK de####needle.net
- DNS ASK he###nature.net
- DNS ASK di####ultneedle.net
- DNS ASK he###needle.net
- DNS ASK le####govern.net
- DNS ASK he####enough.net
- DNS ASK le####enough.net
- DNS ASK he####needle.net
- DNS ASK le####needle.net
- DNS ASK he####nature.net
- DNS ASK le####nature.net
- DNS ASK re####egovern.net
- DNS ASK or###govern.net
- DNS ASK re####eenough.net
- DNS ASK or###enough.net
- DNS ASK re####eneedle.net
- DNS ASK or###needle.net
- DNS ASK re####enature.net
- DNS ASK or###nature.net
- DNS ASK ne####arygovern.net
- DNS ASK pl####ntgovern.net
- DNS ASK ne####aryenough.net
- DNS ASK pl####ntenough.net
- DNS ASK ne####aryneedle.net
- DNS ASK pl####ntneedle.net
- DNS ASK ne####arynature.net
- DNS ASK pl####ntnature.net
- DNS ASK he###govern.net
- DNS ASK di####ultgovern.net
- DNS ASK he###enough.net
- DNS ASK di####ultenough.net
- DNS ASK ge####nature.net
- DNS ASK ge###ecover.net
Другое
Создает и запускает на исполнение
- 'C:\cotvkuvaumsgu\ztk84k9h1cbmu3jtulo.exe'
- 'C:\cotvkuvaumsgu\lfydvtmct.exe'
- 'C:\cotvkuvaumsgu\obmcchksnfnc.exe' "c:\cotvkuvaumsgu\lfydvtmct.exe"
